Cybersecurity, Privacy and Resilience

Introduction and Context

Information technology systems support banking, healthcare, education, government, manufacturing, communication, and everyday personal activity. Their value, however, creates exposure. A stolen password can disclose personal information; malicious code can interrupt a hospital; an altered database record can lead to an incorrect financial decision; and an unavailable cloud service can stop a business process. Cybersecurity is therefore not only a technical concern. It is a requirement of responsible management, professional practice, legal compliance, and public trust.

Cybersecurity is the protection of information and information systems against unauthorized access, use, disclosure, disruption, modification, or destruction. Privacy concerns the appropriate collection, use, sharing, retention, and deletion of information about identifiable individuals. Resilience is the ability of an organization or system to anticipate, withstand, recover from, and adapt to adverse events.

A sound cybersecurity program combines people, processes, and technology. Firewalls and encryption are useful, but they cannot compensate for poor governance, unsafe behavior, weak supplier controls, or an inability to recover from failure. This chapter develops a practical foundation for analyzing threats, designing controls, responding to incidents, and building trustworthy and resilient IT services.

Learning Objectives

After studying this chapter, you should be able to:

1. Apply confidentiality, integrity, and availability principles to information systems.
2. Distinguish threats, vulnerabilities, risks, events, and incidents.
3. Explain common attacks, including malware, phishing, credential theft, and social engineering.
4. Describe authentication, authorization, access control, encryption, and secure operating practices.
5. Explain privacy principles and the ethical responsibilities of IT professionals.
6. Construct a basic incident-response, business-continuity, and disaster-recovery approach.
7. Explain zero-trust architecture and evaluate its benefits and limitations.
8. Analyze cybersecurity decisions in a realistic organizational case.

1. The Core Security Objectives

1.1 Confidentiality, integrity, and availability

The traditional security triad is CIA:

• Confidentiality means that information is accessible only to authorized people, systems, or processes.
• Integrity means that information and systems remain accurate, complete, authentic, and protected from unauthorized alteration.
• Availability means that authorized users can access systems and information when required.

These objectives can conflict. Strong confidentiality controls may make legitimate access slower. Extensive availability may require redundant systems and increased cost. Integrity checks may consume processing resources. Security design is therefore a process of balancing risk, operational need, cost, and legal obligation.

The triad can be extended with related properties. Authenticity concerns whether an identity, message, or source is genuine. Accountability means that actions can be associated with responsible identities through logging and audit trails. Non-repudiation provides evidence that a party performed an action, although no technical mechanism completely eliminates legal or operational disputes.

1.2 Risk terminology

A threat is a potential cause of harm, such as a criminal group, careless employee, fire, or software defect. A vulnerability is a weakness that can be exploited, such as an unpatched server, excessive permissions, or inadequate backup procedures. An asset is something valuable, including data, hardware, software, services, reputation, or human safety. Risk is the possibility that a threat will exploit a vulnerability and produce an adverse impact.

A simple qualitative model is:

Likelihood expresses how probable an event is within a defined period; impact expresses the severity of its consequences. This relationship is a decision model rather than a precise physical law. It is useful for prioritization, but estimates may be uncertain and should be documented with their assumptions.

Organizations may use a quantitative annualized loss model:

where ALE is annualized loss expectancy in currency per year, SLE is single-loss expectancy in currency per event, and ARO is annualized rate of occurrence in events per year. For example, if one outage is estimated to cost $20,000 and is expected 0.25 times per year, ALE = $20,000 × 0.25 = $5,000 per year. The model is only as reliable as the estimates and should not be treated as a guarantee.

Risk treatment options include avoiding an activity, reducing risk through controls, transferring some consequences through contracts or insurance, and accepting residual risk when it is within approved tolerance. Risk acceptance should be explicit, informed, and periodically reviewed.

2. Threats, Vulnerabilities, and Social Engineering

2.1 Common threat categories

Malware is malicious software. Viruses attach to other files, worms self-propagate across networks, trojans disguise themselves as legitimate programs, ransomware encrypts or steals data for extortion, spyware monitors activity, and rootkits attempt to hide privileged control. Modern attacks frequently combine several forms.

Credential attacks include password guessing, credential stuffing using passwords exposed elsewhere, phishing for login details, and theft of session tokens. Password reuse is especially dangerous because one breached service can provide access to many others.

Network and application attacks include denial-of-service, exploitation of unpatched software, injection attacks, insecure application programming interfaces, and interception of poorly protected communications. Misconfiguration is also a major source of exposure: public cloud storage, open administrative interfaces, and excessive permissions can create serious weaknesses without sophisticated exploitation.

Insider threats may be intentional, such as data theft by a disgruntled employee, or unintentional, such as sending a confidential file to the wrong recipient. Third-party suppliers and contractors can also introduce risk through shared systems, software updates, or privileged support access.

2.2 Social engineering

Social engineering manipulates people rather than directly defeating technology. A phishing email may imitate a bank, manager, or cloud provider. Spear phishing targets a particular person using personal or organizational information. Whaling targets senior executives. Vishing uses voice calls, and smishing uses text messages. In a business email compromise, an attacker impersonates an executive or supplier to request payment or confidential information.

Effective defense is layered. Users need awareness training, but training alone is insufficient. Organizations should use multifactor authentication, email authentication and filtering, payment-verification procedures, least privilege, reporting channels, and a culture in which employees can question unusual requests without fear of blame.

Warning signs include urgency, secrecy, unexpected attachments, unusual payment instructions, requests to bypass normal approval, mismatched domains, and messages that ask for passwords or authentication codes. Verification should use a trusted, independent communication channel rather than replying to the suspicious message.

2.3 Vulnerability management

A vulnerability-management process identifies assets, discovers weaknesses, evaluates their severity and exploitability, applies patches or compensating controls, and verifies remediation. Scanners are helpful but imperfect: they may miss unknown vulnerabilities, generate false positives, or fail to understand business context. Penetration testing can demonstrate exploitability, but it is a time-bounded assessment, not proof of security.

Secure configuration baselines, software inventories, change control, code review, dependency management, and timely removal of unsupported software reduce exposure. The most severe technical vulnerability is not always the highest business risk; a moderate weakness in a critical payment system may deserve priority over a severe weakness in an isolated test server.

3. Identity, Authentication, and Access Control

3.1 Authentication factors

Authentication establishes who or what is requesting access. The principal factor categories are:

1. Knowledge: something the subject knows, such as a password or PIN.
2. Possession: something the subject has, such as a security key or authenticator device.
3. Inherence: something the subject is, such as a fingerprint or facial characteristic.
4. Location or behavior, used in some adaptive systems, such as a recognized device or normal access pattern.

Multifactor authentication combines factors from different categories. Two passwords are two knowledge elements, not genuine multifactor authentication. Hardware security keys and cryptographic passkeys can provide strong phishing resistance when properly implemented. Biometrics are convenient but are not secret in the same way as a password; a compromised fingerprint cannot simply be replaced.

Passwords should be long, unique, and stored by services using a slow, salted password-hashing function. A salt is a unique random value stored with the password-derived result; it prevents identical passwords from producing identical stored values and frustrates precomputed attacks. Password managers help users generate and maintain unique credentials.

3.2 Authorization and access-control models

Authorization determines what an authenticated subject may do. Least privilege grants only the access necessary for a task. Need to know restricts access to information required for a particular responsibility. Separation of duties divides sensitive processes among people so that one person cannot complete and conceal an improper transaction.

Common models include:

• Discretionary access control (DAC): resource owners can grant permissions.
• Mandatory access control (MAC): centrally enforced labels and clearances govern access.
• Role-based access control (RBAC): permissions are assigned to job roles.
• Attribute-based access control (ABAC): decisions use attributes such as user, device, location, resource sensitivity, and time.

Access should be reviewed regularly, especially after job changes. Joiner–mover–leaver processes create accounts, modify privileges, and disable access promptly. Privileged accounts should be separate from ordinary accounts, strongly authenticated, monitored, and used only when necessary.

4. Cryptography and Secure Communication

Cryptography transforms information to protect it or establish authenticity.

• Encryption converts plaintext into ciphertext using a key. Decryption recovers the plaintext for an authorized party.
• Symmetric encryption uses the same secret key, or related shared secret, for encryption and decryption. It is efficient for large data volumes, but key distribution must be managed securely.
• Asymmetric cryptography uses a public key and a private key. It supports key establishment and digital signatures but is generally more computationally expensive.
• A cryptographic hash produces a fixed-length digest used to detect changes. A secure hash is designed to make finding collisions computationally impractical, but a hash alone does not prove who created a message.
• A digital signature uses a private key to sign data and a public key to verify the signature. It supports integrity and origin authentication when key ownership is trustworthy.

Encryption in transit protects communications between endpoints, while encryption at rest protects stored information. Encryption does not solve every problem: an authorized malicious user may access decrypted data; keys may be lost or stolen; metadata may remain visible; and weak endpoint security can expose information before encryption or after decryption.

Key management is therefore central. Keys require secure generation, restricted access, rotation where appropriate, backup or recovery procedures, revocation, and controlled destruction. Certificate authorities help bind public keys to identities, but trust infrastructures must themselves be governed and monitored.

5. Secure Practices and Privacy

5.1 Defense in depth

Defense in depth uses multiple, partly independent controls. A secure service may combine strong identity verification, network segmentation, endpoint protection, application validation, logging, backups, and trained personnel. If one control fails, others can limit the damage.

Important practices include secure-by-default configuration, timely patching, endpoint detection, network segmentation, safe input validation, dependency updates, immutable or offline backups, and centralized security logging. Logs should be time-synchronized, protected from unauthorized alteration, retained according to purpose, and reviewed through alerts and investigation procedures.

Security development practices integrate threat modeling, secure design, code review, automated testing, secrets management, and controlled deployment into the software life cycle. Developers should not place passwords or private keys in source code. Production data should not be copied into development environments without appropriate protection and authorization.

5.2 Privacy principles

Privacy is broader than secrecy. Information can be used inappropriately even when it is not disclosed publicly. Good privacy practice commonly includes:

• purpose specification: collect information for clear, legitimate purposes;
• data minimization: collect only what is necessary;
• transparency: explain collection, use, sharing, and retention;
• accuracy: allow correction of inaccurate information;
• storage limitation: retain data no longer than needed;
• security safeguards: protect information against misuse and loss;
• accountability: document decisions and demonstrate compliance.

Privacy regulations differ by jurisdiction, sector, and type of data. Organizations must identify applicable laws, contractual obligations, and rights of individuals rather than assuming that one global rule applies everywhere. Sensitive data may require stronger safeguards, impact assessments, restricted access, and notification procedures.

Ethical practice goes beyond legal compliance. IT professionals should consider power imbalances, discrimination, surveillance, informed consent, secondary uses, and the effects of automated decisions. An application can be legally permitted yet ethically unjustifiable if it collects excessive data or unfairly excludes people.

6. Incident Response

A security incident is an event that threatens confidentiality, integrity, or availability and requires investigation or response. Incident response should be planned before an incident occurs. A typical life cycle is:

1. Preparation: establish policy, roles, contacts, tools, training, backups, and legal procedures.
2. Detection and analysis: identify alerts, validate evidence, determine scope, and classify severity.
3. Containment: limit spread and damage. Short-term containment may isolate systems; longer-term containment may apply temporary controls.
4. Eradication: remove malware, close exploited weaknesses, rotate credentials, and eliminate persistence.
5. Recovery: restore trusted services gradually, monitor for recurrence, and confirm business functionality.
6. Lessons learned: document causes, decisions, communications, costs, and improvements.

Evidence must be handled carefully. Investigators should preserve logs, record collection times, maintain chain of custody where required, and avoid destroying volatile evidence unnecessarily. Communication plans should identify technical, executive, legal, regulatory, customer, employee, and public audiences. Organizations should not conceal material incidents when law or contract requires notification.

A useful incident record distinguishes facts, assumptions, unknowns, actions, and decisions. This prevents premature conclusions and improves later review.

7. Business Continuity and Disaster Recovery

Business continuity maintains or restores critical business functions during disruption. Disaster recovery focuses more specifically on restoring IT infrastructure, applications, data, and services after a serious event. They overlap but are not identical.

A business-impact analysis identifies critical processes, dependencies, acceptable interruption, and consequences. Two central measures are:

• Recovery time objective (RTO): the target maximum time to restore a service after disruption.
• Recovery point objective (RPO): the target maximum amount of data loss measured in time.

For example, an RTO of four hours means the service should be restored within four hours under the defined scenario. An RPO of fifteen minutes means recovery should lose no more than approximately fifteen minutes of transactions, subject to the backup and replication design. These are targets, not guarantees, and must be tested.

Continuity strategies include redundant infrastructure, geographic distribution, alternate work locations, manual workarounds, prioritized restoration, and supplier alternatives. Backups should follow appropriate access controls, be tested through restoration, and be protected from ransomware. A backup that cannot be restored is not a dependable recovery capability.

Exercises may be discussion-based tabletop exercises, technical recovery tests, or full simulations. Testing reveals undocumented dependencies, unrealistic assumptions, unavailable contacts, and insufficient capacity.

8. Zero-Trust Security

Traditional perimeter security assumes that users and devices inside a network are relatively trustworthy. Zero trust rejects implicit trust based on network location. Its central principle is to verify explicitly, apply least-privilege access, and assume that compromise is possible.

A zero-trust design evaluates identity, device health, application, requested resource, context, and risk before granting access. Access is preferably specific, time-limited, continuously monitored, and reevaluated when conditions change. Microsegmentation limits lateral movement if one account or device is compromised.

Zero trust is not a single product and does not mean denying all access. It is an architectural and governance approach involving identity providers, endpoint management, policy engines, application gateways, logging, and data classification. It can improve control in cloud and hybrid environments, but implementation may be costly and complex. Poor identity data, excessive prompts, incompatible legacy systems, and weak policy design can reduce effectiveness.

9. Applied Case: A Ransomware Incident at Northbridge College

Background

Northbridge College, a fictional illustrative organization, operates student records, an online learning platform, payroll, research storage, and public websites. Employees use cloud email and remote access. The college has antivirus software and nightly backups, but backup restoration has not been tested recently.

Problem

An accounts employee receives a convincing message appearing to come from the finance director. The employee follows a link and enters credentials into a fraudulent login page. The attacker uses the credentials to access email, registers a new authentication method, and later deploys ransomware through a file server. Several administrative services become unavailable.

Analysis

The incident involves a social-engineering entry point, weak resistance to credential theft, inadequate monitoring of new authentication methods, excessive lateral access, and uncertain recovery capability. Confidentiality is threatened because files may have been copied. Integrity is threatened because records may have been altered. Availability is directly affected by encryption of shared data.

The college should first activate its incident-response team, isolate affected systems, preserve logs, disable compromised sessions and credentials, and verify whether the attacker still has access. It should avoid restoring infected systems before understanding persistence and should coordinate with legal, privacy, communications, and law-enforcement functions as appropriate.

Approach and solution

The immediate response includes segmentation, emergency identity review, clean-device credential resets, endpoint investigation, and controlled restoration from known-good backups. Critical services are prioritized using the business-impact analysis. Stakeholders receive factual, timely updates without speculation.

Longer-term improvements include phishing-resistant multifactor authentication for privileged and high-risk users, alerts for new authentication methods and unusual downloads, separate administrative accounts, stronger segmentation, tested offline backups, supplier review, and recurring exercises. Staff training is redesigned around realistic reporting and verification rather than blame.

Outcome and learning points

The college restores essential services in stages and confirms data integrity before reopening systems. The post-incident review finds that technology controls existed but were not integrated into a coherent identity, monitoring, and recovery program.

The case demonstrates that security is a system property. A single deceptive message caused harm because several weaknesses aligned. Effective resilience depends on prevention, detection, containment, recovery, and learning—not on any one security product.

10. Governance, Professional Practice, and Emerging Issues

Security governance assigns responsibility, establishes risk appetite, approves policies, and measures performance. Frameworks such as the NIST Cybersecurity Framework and ISO/IEC 27001 can help organizations structure governance, but adopting a framework does not automatically produce security. Controls must fit the organization’s assets, threats, regulatory environment, and operational capacity.

Metrics should support decisions. Useful measures may include time to patch critical vulnerabilities, percentage of privileged accounts using strong authentication, backup-restoration success rate, time to detect and contain incidents, and completion of access reviews. Metrics should avoid encouraging superficial compliance—for example, counting training completion without measuring reporting quality or reduction in risky behavior.

Artificial intelligence can assist with anomaly detection, malware analysis, alert prioritization, code review, and incident summarization. It also creates risks: attackers can automate phishing and reconnaissance; models may expose sensitive prompts; generated code may contain vulnerabilities; and false positives or opaque decisions can mislead analysts. AI systems require access control, data governance, human oversight, testing, and clear accountability.

A mature security culture treats security as shared work. Leaders provide resources and priorities; IT teams implement controls; developers build safely; managers authorize access; employees report concerns; suppliers meet requirements; and auditors provide independent assurance. Professional conduct includes protecting confidentiality, disclosing material risks, respecting privacy, and escalating unsafe conditions.

Best-Practice Checklist

• Identify critical assets, processes, dependencies, and data owners.
• Use unique credentials and phishing-resistant multifactor authentication where feasible.
• Apply least privilege, separation of duties, and timely access removal.
• Patch supported systems and maintain an accurate asset inventory.
• Encrypt sensitive data in transit and at rest, with disciplined key management.
• Segment networks and monitor privileged and unusual activity.
• Collect only necessary personal data and define retention and disposal rules.
• Maintain protected backups and test restoration regularly.
• Prepare and exercise incident-response and continuity plans.
• Treat suppliers, cloud services, applications, and AI tools as part of the security environment.
• Review controls after incidents, major changes, and new threats.

Chapter Summary

Cybersecurity protects confidentiality, integrity, and availability while supporting authenticity and accountability. Threats exploit vulnerabilities affecting valuable assets, and risk assessment helps organizations prioritize controls according to likelihood and impact. Social engineering remains effective because technical systems depend on human decisions; layered controls, strong authentication, verification procedures, and a supportive reporting culture reduce its success.

Authentication establishes identity, authorization determines permitted actions, and access-control models such as RBAC and ABAC help enforce least privilege. Cryptography protects confidentiality and supports integrity and authentication, but its value depends on sound key management and secure endpoints. Privacy requires purposeful collection, minimization, transparency, appropriate retention, and accountability.

Incident response progresses from preparation through detection, containment, eradication, recovery, and lessons learned. Business continuity and disaster recovery use impact analysis, RTO, RPO, redundancy, backups, and testing to preserve essential services. Zero trust removes implicit trust based on network location and continuously evaluates identity, device, context, and resource access. Ultimately, resilience is achieved through coordinated governance, people, processes, technology, and continual improvement.

Key Terms

Availability: Accessibility of systems and information to authorized users when needed.

Authentication: Verification of an identity or system.

Authorization: Determination of what an authenticated subject may access or do.

Business continuity: Capability to maintain or restore critical business functions during disruption.

Confidentiality: Protection against unauthorized disclosure.

Cryptographic hash: Fixed-length digest used primarily to detect data changes.

Disaster recovery: Restoration of IT systems, data, and services after a serious disruption.

Integrity: Protection of information and systems from unauthorized or improper alteration.

Least privilege: Granting only the access required for an authorized task.

Multifactor authentication: Authentication using factors from at least two different categories.

Phishing: Deceptive communication intended to obtain information or cause an unsafe action.

Privacy: Appropriate governance of information about identifiable individuals.

Ransomware: Malicious software used to deny access to data or systems, often for extortion.

Risk: Possibility that threats will exploit vulnerabilities and cause harm.

RPO: Recovery point objective; the targeted maximum acceptable period of data loss.

RTO: Recovery time objective; the targeted maximum time to restore a service.

Social engineering: Manipulation of people to obtain access, information, or an action.

Threat: Potential cause of harm to an asset or system.

Vulnerability: Weakness that can be exploited by a threat.

Zero trust: Security approach that provides no implicit trust and continually verifies access.

Review Questions

Short Answer Questions

1. Define confidentiality, integrity, and availability, giving one example of each.
2. Distinguish a threat from a vulnerability and a risk.
3. Why are two passwords not considered genuine multifactor authentication?
4. What are RTO and RPO, and how do they differ?
5. State three privacy principles that should guide collection of personal information.

Long Answer Questions

1. Explain how defense in depth reduces the consequences of a control failure.
2. Compare discretionary, mandatory, role-based, and attribute-based access control.
3. Describe the stages of a complete incident-response life cycle.
4. Explain how cryptography supports confidentiality, integrity, and authentication, including its limitations.
5. Discuss the relationship between cybersecurity, privacy, business continuity, and organizational governance.

Analytical / Application Questions

1. A university discovers that a former employee’s account remains active six months after departure. Analyze the threats and vulnerabilities involved and recommend preventive and detective controls.
2. A small online retailer can afford either a new firewall or tested offline backups. Using confidentiality, integrity, availability, and risk-prioritization principles, explain what information is needed before deciding.
3. Design a response plan for a phishing incident in which an employee entered credentials into a fraudulent website and the account was used to download customer records. Identify immediate actions, evidence requirements, privacy considerations, recovery steps, and long-term improvements.

Multiple Choice Questions with Answers

Question 1

Which security objective is most directly violated when an unauthorized person reads a customer database?

A. Availability

B. Confidentiality

C. Integrity

D. Recoverability

Correct Answer: B. Confidentiality

Question 2

Which statement best distinguishes a vulnerability from a threat?

A. A vulnerability is a potential attacker, while a threat is a system weakness.

B. A vulnerability is a weakness, while a threat is a potential cause of harm.

C. A vulnerability is always intentional, while a threat is always accidental.

D. A vulnerability is an incident that has already occurred, while a threat is a backup.

Correct Answer: B. A vulnerability is a weakness, while a threat is a potential cause of harm.

Question 3

Which example is genuine multifactor authentication?

A. A password and a second password

B. A PIN and a memorable phrase

C. A password and a hardware security key

D. A username and an email address

Correct Answer: C. A password and a hardware security key

Question 4

What is the primary purpose of a cryptographic hash in ordinary file verification?

A. To recover the original plaintext

B. To detect whether the file has changed

C. To provide physical access to a server

D. To replace all access-control decisions

Correct Answer: B. To detect whether the file has changed

Question 5

An organization estimates a single loss at $20,000 and expects the event 0.25 times per year. What is the annualized loss expectancy?

A. $800

B. $5,000

C. $20,250

D. $80,000

Correct Answer: B. $5,000

Question 6

Which action best demonstrates least privilege?

A. Giving every employee administrator access

B. Allowing an employee only the records required for assigned duties

C. Sharing one account among a whole department

D. Keeping former employees’ permissions indefinitely

Correct Answer: B. Allowing an employee only the records required for assigned duties

Question 7

What does an RPO primarily specify?

A. The maximum targeted time to restore service

B. The maximum targeted amount of data loss measured in time

C. The number of employees required for recovery

D. The time needed to detect phishing

Correct Answer: B. The maximum targeted amount of data loss measured in time

Question 8

Which activity belongs primarily to the containment stage of incident response?

A. Isolating an affected server from the network

B. Writing the original security policy before any incident

C. Deleting all logs immediately

D. Conducting the final lessons-learned meeting

Correct Answer: A. Isolating an affected server from the network

Question 9

Which principle is central to zero-trust security?

A. Trust every device inside the corporate network

B. Permit access permanently after the first login

C. Verify explicitly and apply least privilege

D. Remove all monitoring to improve usability

Correct Answer: C. Verify explicitly and apply least privilege

Question 10

Which practice most directly supports privacy by design?

A. Collecting every available data field for possible future use

B. Retaining personal data permanently

C. Collecting only data necessary for a clearly defined purpose

D. Allowing all employees to access personal information

Correct Answer: C. Collecting only data necessary for a clearly defined purpose